agentplane 0.3.4 → 0.3.6

package/dist/cli/run-cli.test-helpers.js

@@ -6,7 +6,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { gzipSync } from "node:zlib";
-import { afterAll, afterEach, beforeAll } from "vitest";
+import { afterAll, afterEach, beforeAll, beforeEach, vi } from "vitest";
 import { defaultConfig } from "@agentplaneorg/core";
 import { runCli } from "./run-cli.js";
 const execFileAsync = promisify(execFile);
@@ -98,6 +98,17 @@ export function registerAgentplaneHome() {
         }));
     });
 }
+export function installRunCliIntegrationHarness() {
+    registerAgentplaneHome();
+    let restoreStdIO = null;
+    beforeEach(() => {
+        restoreStdIO = silenceStdIO();
+    });
+    afterEach(() => {
+        restoreStdIO?.();
+        restoreStdIO = null;
+    });
+}
 export function getAgentplaneHome() {
     return agentplaneHome;
 }
@@ -150,6 +161,26 @@ export function silenceStdIO() {
         }
     };
 }
+export function stubTaskBackend(overrides = {}) {
+    return {
+        id: "local",
+        capabilities: {
+            canonical_source: "local",
+            projection: "canonical",
+            reads_from_projection_by_default: false,
+            writes_task_readmes: true,
+            may_access_network_on_read: false,
+            may_access_network_on_write: false,
+            supports_projection_refresh: false,
+            supports_push_sync: false,
+            supports_snapshot_export: false,
+        },
+        listTasks: vi.fn().mockResolvedValue([]),
+        getTask: vi.fn().mockResolvedValue(null),
+        writeTask: vi.fn().mockImplementation(() => Promise.resolve()),
+        ...overrides,
+    };
+}
 export async function runCliSilent(args) {
     const io = captureStdIO();
     try {
@@ -215,11 +246,60 @@ export async function createRecipeArchive(opts) {
         name: opts?.name ?? "Viewer",
         summary: opts?.summary ?? "Preview task artifacts",
         description: opts?.description ?? "Provides a local viewer for task artifacts.",
-        agents: [{ id: "RECIPE_AGENT", summary: "Recipe agent", file: "agents/recipe.json" }],
+        compatibility: {
+            min_agentplane_version: "0.3.5",
+            manifest_api_version: "1",
+            scenario_api_version: "1",
+            runtime_api_version: "1",
+            platforms: ["darwin", "linux"],
+            repo_types: ["generic"],
+        },
+        skills: [
+            {
+                id: "RECIPE_SKILL",
+                summary: "Recipe analysis skill",
+                kind: "agent-skill",
+                file: "skills/analysis.json",
+            },
+        ],
+        agents: [
+            {
+                id: "RECIPE_AGENT",
+                display_name: "Recipe Agent",
+                role: "executor",
+                summary: "Recipe agent",
+                skills: ["RECIPE_SKILL"],
+                tools: ["RECIPE_TOOL"],
+                file: "agents/recipe.json",
+            },
+        ],
         tools: [
             { id: "RECIPE_TOOL", summary: "Recipe tool", runtime: "node", entrypoint: "tools/run.js" },
         ],
-        scenarios: [{ id: "RECIPE_SCENARIO", summary: "Recipe scenario" }],
+        scenarios: [
+            {
+                id: "RECIPE_SCENARIO",
+                name: "Recipe Scenario",
+                summary: "Recipe scenario",
+                use_when: ["Task artifacts need local preview"],
+                required_inputs: ["task_id"],
+                outputs: ["report"],
+                permissions: ["filesystem-write"],
+                artifacts: ["artifact.txt"],
+                agents_involved: ["RECIPE_AGENT"],
+                skills_used: ["RECIPE_SKILL"],
+                tools_used: ["RECIPE_TOOL"],
+                run_profile: {
+                    mode: "analysis",
+                    sandbox: "workspace-write",
+                    network: false,
+                    requires_human_approval: false,
+                    writes_artifacts_to: ["logs/", "reports/"],
+                    expected_exit_contract: "report",
+                },
+                file: "scenarios/recipe-scenario.json",
+            },
+        ],
     };
     if (normalizedTags) {
         manifest.tags = normalizedTags;
@@ -232,6 +312,13 @@ export async function createRecipeArchive(opts) {
         role: "Recipe agent",
         description: "Example agent installed from a recipe.",
     }, null, 2), "utf8");
+    const skillsDir = path.join(recipeDir, "skills");
+    await mkdir(skillsDir, { recursive: true });
+    await writeFile(path.join(skillsDir, "analysis.json"), JSON.stringify({
+        id: "RECIPE_SKILL",
+        summary: "Recipe analysis skill",
+        kind: "agent-skill",
+    }, null, 2), "utf8");
     const toolsDir = path.join(recipeDir, "tools");
     await mkdir(toolsDir, { recursive: true });
     await writeFile(path.join(toolsDir, "run.js"), [
@@ -302,22 +389,67 @@ export async function createUnsafeRecipeArchive(opts) {
         name: "Unsafe",
         summary: "Unsafe recipe",
         description: "Used for archive validation tests.",
-        agents: [{ id: "RECIPE_AGENT", summary: "Recipe agent", file: "agents/recipe.json" }],
+        skills: [
+            {
+                id: "RECIPE_SKILL",
+                summary: "Recipe skill",
+                kind: "agent-skill",
+                file: "skills/recipe.json",
+            },
+        ],
+        agents: [
+            {
+                id: "RECIPE_AGENT",
+                display_name: "Recipe Agent",
+                role: "executor",
+                summary: "Recipe agent",
+                skills: ["RECIPE_SKILL"],
+                tools: ["RECIPE_TOOL"],
+                file: "agents/recipe.json",
+            },
+        ],
         tools: [
             { id: "RECIPE_TOOL", summary: "Recipe tool", runtime: "bash", entrypoint: "tools/run.sh" },
         ],
-        scenarios: [{ id: "RECIPE_SCENARIO", summary: "Recipe scenario" }],
+        scenarios: [
+            {
+                id: "RECIPE_SCENARIO",
+                name: "Recipe Scenario",
+                summary: "Recipe scenario",
+                use_when: ["Unsafe validation fixture"],
+                required_inputs: [],
+                outputs: [],
+                permissions: [],
+                artifacts: [],
+                agents_involved: ["RECIPE_AGENT"],
+                skills_used: ["RECIPE_SKILL"],
+                tools_used: ["RECIPE_TOOL"],
+                run_profile: { mode: "analysis" },
+                file: "scenarios/recipe-scenario.json",
+            },
+        ],
     };
     await writeFile(path.join(recipeDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
     const agentsDir = path.join(recipeDir, "agents");
     await mkdir(agentsDir, { recursive: true });
     await writeFile(path.join(agentsDir, "recipe.json"), JSON.stringify({ id: "RECIPE_AGENT", role: "Recipe agent" }, null, 2), "utf8");
+    const skillsDir = path.join(recipeDir, "skills");
+    await mkdir(skillsDir, { recursive: true });
+    await writeFile(path.join(skillsDir, "recipe.json"), JSON.stringify({ id: "RECIPE_SKILL" }), "utf8");
     const toolsDir = path.join(recipeDir, "tools");
     await mkdir(toolsDir, { recursive: true });
     await writeFile(path.join(toolsDir, "run.sh"), "#!/usr/bin/env bash\n", "utf8");
     const scenariosDir = path.join(recipeDir, "scenarios");
     await mkdir(scenariosDir, { recursive: true });
-    await writeFile(path.join(scenariosDir, "recipe-scenario.json"), JSON.stringify({ schema_version: "1", id: "RECIPE_SCENARIO", summary: "Recipe scenario" }, null, 2), "utf8");
+    await writeFile(path.join(scenariosDir, "recipe-scenario.json"), JSON.stringify({
+        schema_version: "1",
+        id: "RECIPE_SCENARIO",
+        summary: "Recipe scenario",
+        goal: "Exercise unsafe archive validation.",
+        inputs: [],
+        outputs: [],
+        steps: [{ tool: "RECIPE_TOOL" }],
+    }, null, 2), "utf8");
     const entryPath = opts.entryPath ?? "../evil.txt";
     await writeFile(path.join(baseDir, "evil.txt"), "evil", "utf8");
     const archivePath = opts.format === "zip" ? path.join(baseDir, "unsafe.zip") : path.join(baseDir, "unsafe.tar.gz");

package/dist/commands/commit.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commit.spec.d.ts","sourceRoot":"","sources":["../../src/commands/commit.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOvD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CA8JhD,CAAC"}
+{"version":3,"file":"commit.spec.d.ts","sourceRoot":"","sources":["../../src/commands/commit.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOvD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CA+JhD,CAAC"}

package/dist/commands/commit.spec.js

@@ -3,7 +3,7 @@ import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../share
 export const commitSpec = {
     id: ["commit"],
     group: "Guard",
-    summary: "Create a git commit after validating policy and allowlist against staged changes.",
+    summary: "Create a git commit after validating policy and allowlist; if the index is empty, stage matching allowlist paths first.",
     args: [{ name: "task-id", required: true, valueHint: "<task-id>" }],
     options: [
         {
@@ -49,7 +49,7 @@ export const commitSpec = {
             kind: "boolean",
             name: "allow-tasks",
             default: false,
-            description: "Allow task workflow artifacts (tasks/ and .agentplane/tasks/).",
+            description: "Allow the tasks export snapshot plus artifacts under the active task subtree.",
         },
         {
             kind: "boolean",

package/dist/commands/doctor/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/commands/doctor/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAyB5D,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,MAAM,EAAE,CA+BxF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAM1E"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/commands/doctor/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAsB5D,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,MAAM,EAAE,CA+BxF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAM1E"}

package/dist/commands/doctor/runtime.js

@@ -10,10 +10,7 @@ function renderCliVersionFacts(expectation) {
             ...(expectation.recovery ? [`[WARN] Recovery: ${expectation.recovery}`] : []),
         ];
     }
-    return [
-        `[INFO] Repository expected agentplane CLI: ${expectation.expectedVersion}`,
-        ...(expectation.summary ? [`[INFO] ${expectation.summary}`] : []),
-    ];
+    return [];
 }
 export function checkRuntimeSourceFacts(cwd, config) {
     const report = resolveRuntimeSourceInfo({ cwd, entryModuleUrl: import.meta.url });
@@ -25,9 +22,9 @@ export function checkRuntimeSourceFacts(cwd, config) {
     }
     const warning = report.mode === "global-in-framework"
         ? "[WARN] Framework checkout detected but the active runtime is still a global installed binary. " +
-            "Update or reinstall agentplane to pick up repo-local handoff, or run the repo-local binary directly."
+            "Run scripts/reinstall-global-agentplane.sh to refresh the wrapper, or run the repo-local binary directly."
         : report.mode === "global-forced-in-framework"
-            ? "[WARN] Framework checkout is forcing the global installed binary via AGENTPLANE_USE_GLOBAL_IN_FRAMEWORK=1."
+            ? "[WARN] Framework checkout is forcing the global installed binary via AGENTPLANE_USE_GLOBAL_IN_FRAMEWORK=1. Unset it unless that override is intentional."
             : null;
     return [
         ...(warning ? [warning] : []),

package/dist/commands/doctor/workspace.d.ts

@@ -1,2 +1,5 @@
-export declare function checkWorkspace(repoRoot: string): Promise<string[]>;
+import { type CommandContext } from "../shared/task-backend.js";
+export declare function checkWorkspace(repoRoot: string, opts?: {
+    ctx?: CommandContext;
+}): Promise<string[]>;
 //# sourceMappingURL=workspace.d.ts.map

package/dist/commands/doctor/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/doctor/workspace.ts"],"names":[],"mappings":"AAqIA,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsDxE"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/doctor/workspace.ts"],"names":[],"mappings":"AAQA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA6NpF,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,cAAc,CAAA;CAAE,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC,CAyDnB"}

package/dist/commands/doctor/workspace.js

@@ -3,6 +3,8 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { renderDiagnosticFinding } from "../../shared/diagnostics.js";
 import { resolvePolicyGatewayForRepo } from "../../shared/policy-gateway.js";
+import { GitContext } from "../shared/git-context.js";
+import { listTaskProjection } from "../shared/task-backend.js";
 async function pathExists(absPath) {
     try {
         await fs.access(absPath);
@@ -44,7 +46,14 @@ async function listMissingManagedPolicyFiles(repoRoot) {
     }
     return missing.toSorted();
 }
-async function checkTaskReadmeMigrationState(repoRoot) {
+function taskDataToSnapshot(task) {
+    return {
+        id: task.id,
+        status: task.status,
+        doc_version: task.doc_version,
+    };
+}
+async function readTaskDocSnapshotsFromTasksJson(repoRoot) {
     const tasksPath = path.join(repoRoot, ".agentplane", "tasks.json");
     let raw = "";
     try {
@@ -60,7 +69,22 @@ async function checkTaskReadmeMigrationState(repoRoot) {
     catch {
         return [];
     }
-    const tasks = Array.isArray(parsed.tasks) ? parsed.tasks : [];
+    return Array.isArray(parsed.tasks) ? parsed.tasks : [];
+}
+async function readTaskDocSnapshotsFromProjection(ctx) {
+    if (!ctx)
+        return null;
+    try {
+        const tasks = await listTaskProjection(ctx);
+        if (tasks === null)
+            return null;
+        return tasks.map((task) => taskDataToSnapshot(task));
+    }
+    catch {
+        return null;
+    }
+}
+function buildTaskReadmeMigrationFindings(tasks) {
     if (tasks.length === 0)
         return [];
     const legacy = tasks.filter((task) => task.doc_version !== 3);
@@ -114,7 +138,66 @@ async function checkTaskReadmeMigrationState(repoRoot) {
         }),
     ];
 }
-export async function checkWorkspace(repoRoot) {
+async function checkTaskReadmeMigrationState(repoRoot, ctx) {
+    const projectionTasks = await readTaskDocSnapshotsFromProjection(ctx);
+    const tasks = projectionTasks && projectionTasks.length > 0
+        ? projectionTasks
+        : await readTaskDocSnapshotsFromTasksJson(repoRoot);
+    return buildTaskReadmeMigrationFindings(tasks);
+}
+async function readUntrackedPaths(repoRoot, ctx) {
+    try {
+        const git = ctx?.git ?? new GitContext({ gitRoot: repoRoot });
+        return new Set(await git.statusUntrackedPaths());
+    }
+    catch {
+        return new Set();
+    }
+}
+async function checkDoneTaskReadmeArchiveDrift(repoRoot, ctx) {
+    const projectionTasks = await readTaskDocSnapshotsFromProjection(ctx);
+    const tasks = projectionTasks && projectionTasks.length > 0
+        ? projectionTasks
+        : await readTaskDocSnapshotsFromTasksJson(repoRoot);
+    if (tasks.length === 0)
+        return [];
+    const workflowDir = (ctx?.config.paths.workflow_dir ?? ".agentplane/tasks").replaceAll("\\", "/");
+    const untracked = await readUntrackedPaths(repoRoot, ctx);
+    if (untracked.size === 0)
+        return [];
+    const affected = tasks
+        .filter((task) => {
+        const status = typeof task.status === "string" ? task.status.trim().toUpperCase() : "";
+        const taskId = typeof task.id === "string" ? task.id.trim() : "";
+        if (status !== "DONE" || !taskId)
+            return false;
+        return untracked.has(`${workflowDir}/${taskId}/README.md`);
+    })
+        .map((task) => String(task.id))
+        .toSorted();
+    if (affected.length === 0)
+        return [];
+    const examples = affected.slice(0, 5).join(", ");
+    const stagedCommand = `git add ${affected
+        .map((taskId) => `${workflowDir}/${taskId}/README.md`)
+        .join(" ")}`;
+    return [
+        renderDiagnosticFinding({
+            severity: "WARN",
+            state: "DONE task archive README files exist on disk but are missing from the git index",
+            likelyCause: "task metadata reached DONE state, but the human-readable task README archive never landed in a tracked close commit",
+            nextAction: {
+                command: stagedCommand,
+                reason: "stage the missing archived task README files and commit them before continuing",
+            },
+            details: [
+                `Affected DONE tasks: ${affected.length}`,
+                examples ? `Examples: ${examples}` : "Examples unavailable.",
+            ],
+        }),
+    ];
+}
+export async function checkWorkspace(repoRoot, opts) {
     const problems = [];
     const requiredFiles = [path.join(repoRoot, ".agentplane", "config.json")];
     for (const filePath of requiredFiles) {
@@ -160,6 +243,6 @@ export async function checkWorkspace(repoRoot) {
     if (!hasJson) {
         problems.push("No agent profiles found in .agentplane/agents (*.json expected).");
     }
-    problems.push(...(await checkTaskReadmeMigrationState(repoRoot)));
+    problems.push(...(await checkTaskReadmeMigrationState(repoRoot, opts?.ctx)), ...(await checkDoneTaskReadmeArchiveDrift(repoRoot, opts?.ctx)));
     return problems;
 }

package/dist/commands/doctor.run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.run.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAYrD,eAAO,MAAM,SAAS,EAAE,cAAc,CAAC,YAAY,CAuDlD,CAAC"}
+{"version":3,"file":"doctor.run.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAarD,eAAO,MAAM,SAAS,EAAE,cAAc,CAAC,YAAY,CA6DlD,CAAC"}

package/dist/commands/doctor.run.js

@@ -1,5 +1,6 @@
 import { loadConfig, resolveProject } from "@agentplaneorg/core";
 import { warnMessage, successMessage } from "../cli/output.js";
+import { loadCommandContext } from "./shared/task-backend.js";
 import { checkDoneTaskCommitInvariants } from "./doctor/archive.js";
 import { safeFixGitignore, safeFixTaskIndex } from "./doctor/fixes.js";
 import { checkLayering } from "./doctor/layering.js";
@@ -11,9 +12,15 @@ export const runDoctor = async (ctx, p) => {
     const resolved = await resolveProject({ cwd: ctx.cwd, rootOverride: ctx.rootOverride ?? null });
     const repoRoot = resolved.gitRoot;
     const loadedConfig = await loadConfig(resolved.agentplaneDir);
+    const commandCtx = await loadCommandContext({
+        cwd: ctx.cwd,
+        rootOverride: ctx.rootOverride ?? null,
+        resolvedProject: resolved,
+        config: loadedConfig.config,
+    });
     const runChecks = async () => {
         let checks = [
-            ...(await checkWorkspace(repoRoot)),
+            ...(await checkWorkspace(repoRoot, { ctx: commandCtx })),
             ...checkRuntimeSourceFacts(ctx.cwd, loadedConfig.config),
             ...(await checkDoneTaskCommitInvariants(repoRoot, { fullArchive: p.archiveFull })),
         ];

package/dist/commands/guard/commit.command.js

@@ -34,7 +34,7 @@ export const guardCommitSpec = {
             kind: "boolean",
             name: "allow-tasks",
             default: false,
-            description: "Allow task workflow artifacts (tasks/ and .agentplane/tasks/).",
+            description: "Allow the tasks export snapshot plus artifacts under the active task subtree.",
         },
         {
             kind: "boolean",

package/dist/commands/guard/impl/allow.d.ts

@@ -14,5 +14,10 @@ export declare function stageAllowlist(opts: {
     allow: string[];
     allowTasks: boolean;
     tasksPath: string;
+    workflowDir?: string;
+    taskId?: string;
+    allowTaskOnly?: boolean;
+    emptyAllowMessage?: string;
+    noMatchMessage?: string;
 }): Promise<string[]>;
 //# sourceMappingURL=allow.d.ts.map

package/dist/commands/guard/impl/allow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkDpB"}
+{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAOA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAuDpB"}

package/dist/commands/guard/impl/allow.js

@@ -2,6 +2,7 @@ import { resolveProject } from "@agentplaneorg/core";
 import { exitCodeForError } from "../../../cli/exit-codes.js";
 import { gitPathIsUnderPrefix, normalizeGitPathPrefix } from "../../../shared/git-path.js";
 import { CliError } from "../../../shared/errors.js";
+import { taskArtifactPrefixes } from "../../../shared/protected-paths.js";
 import { GitContext } from "../../shared/git-context.js";
 import { loadCommandContext } from "../../shared/task-backend.js";
 function normalizeAllowPrefixes(prefixes) {
@@ -75,28 +76,32 @@ export async function stageAllowlist(opts) {
         });
     }
     const allow = normalizeAllowPrefixes(opts.allow);
-    if (allow.length === 0) {
+    if (allow.includes(".")) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "Provide at least one allowed prefix",
+            message: "Repo-wide allowlist ('.') is not allowed; choose minimal prefixes (tip: `agentplane guard suggest-allow --format args`).",
         });
     }
-    if (allow.includes(".")) {
+    const taskAllow = taskArtifactPrefixes({
+        tasksPath: opts.tasksPath,
+        workflowDir: opts.workflowDir,
+        taskId: opts.taskId,
+    });
+    const effectiveAllow = normalizeAllowPrefixes(opts.allowTasks ? [...allow, ...taskAllow] : allow);
+    if (effectiveAllow.length === 0 || (allow.length === 0 && opts.allowTaskOnly !== true)) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "Repo-wide allowlist ('.') is not allowed; choose minimal prefixes (tip: `agentplane guard suggest-allow --format args`).",
+            message: opts.emptyAllowMessage ?? "Provide at least one allowed prefix",
         });
     }
-    const denied = new Set();
-    if (!opts.allowTasks)
-        denied.add(opts.tasksPath);
+    const denied = opts.allowTasks ? [] : taskAllow;
     const staged = [];
     for (const filePath of changed) {
-        if (denied.has(filePath))
+        if (denied.some((prefix) => gitPathIsUnderPrefix(filePath, prefix)))
             continue;
-        if (allow.some((prefix) => gitPathIsUnderPrefix(filePath, prefix))) {
+        if (effectiveAllow.some((prefix) => gitPathIsUnderPrefix(filePath, prefix))) {
             staged.push(filePath);
         }
     }
@@ -105,7 +110,7 @@ export async function stageAllowlist(opts) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "No changes matched allowed prefixes (update --commit-allow)",
+            message: opts.noMatchMessage ?? "No changes matched allowed prefixes (update --commit-allow)",
         });
     }
     // `git add <pathspec>` is not reliable for staging deletes/renames across versions/configs.

package/dist/commands/guard/impl/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAuExE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAa9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgKlB"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyLxE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAa9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmMlB"}